Privacy policy

Last updated: 19 October 2026

This policy explains which personal data we collect when you visit pink-flamingo.gr, buy from us or contact us, why we use it, who receives it and what rights you have. It is written in line with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019.

1. Who is responsible for your data

The controller of your personal data is Pink Flamingo, P. Kyda 118, Myrina, Limnos 81400, Greece, VAT no. (ΑΦΜ) 068726270, GEMI no. 142316442000, phone +30 22540 27208, email info@pink-flamingo.gr. For any question about your data, write to us at that address. As a small business we have not appointed a data protection officer.

2. What data we collect

  • Order data: name, billing and delivery address, email, phone number, the products you buy, the amount, the payment and delivery method, and any notes you add. If you ask for an invoice, also your business details and VAT number.
  • Customer account: if you create one, your login details, your addresses and your order history.
  • Payment data: card payments are made on the secure page of Alpha Bank (Nexi) and PayPal payments on PayPal’s pages. We never see or store your full card details; we receive only a confirmation of the payment and limited details such as the transaction number.
  • Messages: what you write to us through the contact form, by email or by phone, including withdrawal and return requests.
  • Newsletter: your email address and, if you give it, your name, if you subscribe.
  • Basket reminders: if you agree to receive them, the email address you type at checkout and the contents of your basket.
  • Wishlist: the products you save, linked to your account or to a cookie in your browser.
  • Technical and usage data: your IP address, browser and device type, the pages you visit and when, collected in server and security logs and, only with your consent, by statistics and marketing tools (see our cookie policy).

3. Why we use it and on what legal basis

  • To process and deliver your order, take payment, handle returns, withdrawals and guarantee claims, and keep your account: performance of the contract (Article 6(1)(b) GDPR).
  • To issue receipts and invoices, transmit them to the Independent Authority for Public Revenue (AADE, myDATA) and keep accounting records: compliance with our legal obligations (Article 6(1)(c) GDPR).
  • To answer your messages: taking steps at your request before a contract, or our legitimate interest in answering enquiries (Article 6(1)(b) and (f) GDPR).
  • To protect the website, our customers and us against fraud, spam and attacks (security plug-ins, server logs, spam filtering of the contact form): our legitimate interest in a secure shop (Article 6(1)(f) GDPR).
  • To send you our newsletter: your consent (Article 6(1)(a) GDPR). You can unsubscribe at any time with the link in every newsletter or by writing to us.
  • To remind you of a basket you did not complete: your consent, given at checkout (Article 6(1)(a) GDPR). We send at most two reminders and you can stop them at any time.
  • To measure how our website is used (statistics) and to show you our adverts on Facebook and Instagram and measure them (marketing): your consent, given in the cookie banner (Article 6(1)(a) GDPR and Article 4(5) of Law 3471/2006).
  • To offer the accessibility toolbar (Ally) on every page: our legitimate interest in making the shop usable for everyone, including people with disabilities (Article 6(1)(f) GDPR). The toolbar is a necessary accessibility tool, so it loads for every visitor without waiting for cookie consent.
  • To establish, exercise or defend legal claims: our legitimate interest (Article 6(1)(f) GDPR).

Giving us your order details is necessary to conclude and carry out the contract; without them we cannot accept your order. Everything else is optional. We do not use automated decision-making, including profiling, that produces legal effects for you.

4. Who receives your data

We share personal data only as far as necessary, with:

  • Delivery: the postal or courier company delivering your order (name, address, phone and, for cash on delivery, the amount to collect).
  • Payments: Alpha Bank and its payment processor Nexi (card payments), PayPal (Europe) S.à r.l. et Cie, S.C.A. (PayPal payments), and our bank for bank transfers.
  • Tax and accounting: our accountant, our certified electronic invoicing provider and the Independent Authority for Public Revenue (AADE, myDATA).
  • Website hosting: Hostinger, which hosts the website and its database.
  • Email: our mailbox provider (Titan), through which we send order emails and receive your messages.
  • Newsletter and basket reminders: Mailchimp (Intuit Inc.), which stores our subscriber list and sends the newsletter. Basket reminders are sent from our own website.
  • Statistics (only with your consent): Google Ireland Ltd (Google Analytics 4) and Automattic Inc. (Jetpack Stats).
  • Marketing (only with your consent): Meta Platforms Ireland Ltd (Facebook Pixel and Conversions API, for measuring and showing our adverts on Facebook and Instagram) and Mailchimp (site tracking). If we list our products on Google’s free shopping listings, Google receives our product data; any Google tag on our site runs only with your consent.
  • Security: Defiant Inc. (Wordfence), which checks visits and login attempts against known threats.
  • Accessibility toolbar: Elementor Ltd, which provides the Ally accessibility toolbar. The toolbar is loaded from Elementor’s servers on every page, so they receive your IP address and technical data such as your browser type and the address of the page; Elementor also counts toolbar loads for its service plan.
  • Authorities: public authorities and courts, where the law requires it.

Our service providers act on our instructions under data processing agreements. PayPal, our bank, Meta and Google may also act as independent controllers for their own purposes; their privacy policies apply to that processing. We never sell your personal data.

5. Transfers outside the EU

Some of the providers above (Mailchimp, Google, Meta, Automattic, Defiant, Titan, Elementor) are based in, or may access data from, countries outside the European Economic Area, mainly the United States. Such transfers take place only on the basis of an adequacy decision of the European Commission (for the United States, the EU–US Data Privacy Framework for certified companies; for Israel, the Commission’s adequacy decision) or of the Commission’s standard contractual clauses. You can ask us for more information on the safeguards used.

6. How long we keep it

  • Order, invoice and accounting records: for as long as Greek tax and commercial law requires (generally at least 5 years from the end of the tax year, and longer while a tax audit or dispute is pending).
  • Customer account: until you ask us to delete it; orders in it are kept as above.
  • Messages and withdrawal or guarantee requests: as long as needed to deal with them and for the limitation periods of any related claims.
  • Newsletter: until you unsubscribe.
  • Basket reminder data: deleted once the order is completed, or at the latest 30 days after the basket was abandoned.
  • Statistics and marketing cookies: see the durations in our cookie policy.
  • Security logs: for a short period, as needed to protect the website.

7. Your rights

You have the right to:

  • access your personal data and receive a copy;
  • have inaccurate data corrected or incomplete data completed;
  • have your data erased, where there is no legal reason for us to keep it;
  • restrict the processing of your data in certain cases;
  • receive the data you gave us in a structured, machine-readable format, or have it transmitted to another controller (portability);
  • object at any time to processing based on our legitimate interest and, without giving reasons, to the use of your data for direct marketing;
  • withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal: unsubscribe from the newsletter, or change your choices through ‘Manage consent’ on our website.

To exercise your rights, write to info@pink-flamingo.gr or to our postal address. We answer within one month; we may ask you to confirm your identity. Exercising your rights is free of charge.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), 1–3 Kifisias Avenue, 115 23 Athens, www.dpa.gr.

8. Cookies

We use cookies that are necessary for the shop to work, and, only with your consent, statistics and marketing cookies. Details are in our cookie policy.

Cookie policy

9. Security

Our website uses an encrypted connection (HTTPS). We protect our systems with security software, regular updates and restricted access, and we ask our providers to do the same. No transmission over the internet is completely secure, but we take appropriate technical and organisational measures to protect your data.

10. Children

Our shop is intended for adults. We do not knowingly collect personal data of children under 15; if you believe a child has given us personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this policy when our services or the law change. The date of the latest update is shown at the top of this page; for important changes we will also inform you by other appropriate means.